CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)
Apache CXF can expand a small attacker DEFLATE payload into gigabytes, causing a decompression-bomb denial of service.
48
Vulnerability2 · 1 read
CVE-2026-78384
Unbounded DEFLATE bomb in Apache CXF JOSE and SAML
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache CXF's CompressionUtils.inflate() expanded attacker-controlled DEFLATE data with no output-size limit, so a small (kilobyte-scale) payload could grow to gigabytes on the heap. The path is reachable during JWE decryption when zip=DEF (including JoseSessionTokenProvider with RSA-OAEP key wrap) and during SAML redirect or POST binding token inflation, and decompression runs before or independently of trust validation. An attacker who can submit such a token can exhaust memory and deny service; this is not described as code execution. It affects Apache CXF releases prior to the fixed builds 3.6.13, 4.1.9, and 4.2.4, which abort with DataFormatException once a configurable cap (default 10 MiB, org.apache.cxf.compression-max-inflated-size) is exceeded. There is no known public proof of concept and it is not listed in CISA KEV.
What to do: Upgrade Apache CXF to 4.2.4, 4.1.9, or 3.6.13. Until then, set the system property org.apache.cxf.compression-max-inflated-size to a tight cap and treat untrusted JWE (zip=DEF) and SAML redirect/POST bindings as untrusted input that is inflated before trust checks.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache CXF | Versions before the fixes in 3.6.13, 4.1.9, and 4.2.4 (those releases add the inflated-size cap) |
Estimated exposure
largeOn the order of 100,000+ Java service deployments that embed CXF JOSE or SAML processing — Apache CXF is a widely embedded enterprise Java SOAP/REST and token stack (JOSE/JWE and SAML), but there is no public active-install census or internet scan count for this CVE, so the figure is an order-of-magnitude deployment estimate…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wrap) and via SAML redirect/POST binding token inflation — in both cases decompression happens before/independent of trust validation. Fix: Added a configurable maximum inflated-size cap (default 10 MiB, org.apache.cxf.compression-max-inflated-size system property) to CompressionUtils.inflate(); aborts with DataFormatException once exceeded. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.